topic Re: PermissionService.setPermission to deny access to file owner in Alfresco Archive

PermissionService.setPermission to deny access to file owner

francesco_lilli — Mon, 10 Feb 2014 01:33:05 GMT

Hi,I'm experiencing an issue with the PermissionService.Say I have a file called "test.txt", being "bob" the username of its owner. Such file is inside the documentLibrary (three/four levels of depth).Since "bob" is the owner, he has full permissions on the file. At some point I have to deny write a

Re: PermissionService.setPermission to deny access to file owner

afaust — Mon, 10 Feb 2014 07:03:13 GMT

Hello,

you have to keep in mind the dynamic role of OWNER. Any user that is either the owner (cmwner) or - when no cmwner is set - the creator (cm:creator) automatically has the OWNER role on that node, and this role always has full access privileges and can't be denied via the permission service (note: the admin can <b>never</b> be denied anything).
Only if you either a) disable the OWNER role via the permission services Spring bean configuration or b) set the cmwner to an empty String can you disable this behavior and achieve truly ACL-only-based permissions.

Regards
Axel

Re: PermissionService.setPermission to deny access to file owner

francesco_lilli — Mon, 10 Feb 2014 08:36:00 GMT

Hi Axel,
thanks for your reply. I have tried to set the cmwner to an empty string, it works fine. However I'd rather not go for this way, since I need to disable writings several times on the same file (i.e., when a certain workflow starts, this file cannot be modified by anyone; when a user refuses a task in that workflow the file needs to be editable again, and when edited it must become non-editable ). I should set and unset the owner of the file several times, not just once: setting/unsetting the owner doesn't seem to be a clean solution in this case.
About the other way you suggested (disable the OWNER role via the permission services Spring bean configuration), this is also not the perfect way to go: only in this particular case (i.e. the workflow) permissions need to behave this way, but as I said this is a particular case.
How would you proceed, given such requirements?

Re: PermissionService.setPermission to deny access to file owner

francesco_lilli — Mon, 10 Feb 2014 08:49:00 GMT

Wait, which file do you mean with "the permission services Spring bean configuration"? At first I thought you meant "permissionDefinitions.xml" but is it maybe "public-services-security-context.xml"? What would you change in there?

Re: PermissionService.setPermission to deny access to file owner

kaynezhang — Mon, 10 Feb 2014 13:51:08 GMT

Permissions and their groupings are defined in permissionDefinitions.xml. permissionDefinitions.xml is referenced by public-services-security-context.xml.
I think you can modify permissionDefinitions.xml.

Re: PermissionService.setPermission to deny access to file owner

francesco_lilli — Mon, 10 Feb 2014 14:36:26 GMT

I've been trying to edit permissionDefinitions.xml like this:


…
<!– <globalPermission permission="FullControl" authority="ROLE_OWNER"/> –>
<globalPermission permission="Read" authority="ROLE_OWNER"/>
…
‍‍‍‍‍‍

and (odd enough) nothing changed.. But probably there's something else I should know about. I'd probably need to go deeper into the matter, but I'm sure you experienced guys know what I'm missing…